2026

Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumptio

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autono

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseMo

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Inf

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_he

Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co.

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNo

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.g

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command I

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Sof

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated at

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated at

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated at

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated a

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to

tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks hea

A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows re

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows mal

libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause

libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that al

libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authe

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the e

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the

Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor t

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is nev

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRo

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowin

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker t

A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/w

GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binar

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The deco

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Pl

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of

An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway version

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short i

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free x

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcu_read_lock(), skb_dst_force()

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutati

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siw_qp_mo

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the